mcp-server-mcpindex 0.3.7 → 0.3.9

package/CHANGELOG.md

@@ -4,6 +4,23 @@ All notable changes to `mcp-server-mcpindex` are recorded here.
 
 The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/) and the project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.3.9] - 2026-07-15
+
+### Changed
+
+- **Tool descriptions now have a single source of truth (`src/tools-meta.json`).** The stdio CLI (`src/index.mjs`) and the hosted remote endpoint both import the shared name/title/description for the 6 tools, so their copy can no longer drift. Description text is byte-identical to 0.3.8; this is an internal refactor with no change to the advertised tool copy. Bumped so the refactored source is releasable to npm.
+
+## [0.3.8] - 2026-07-15
+
+### Fixed
+
+- **Empty `MCPINDEX_API_BASE` no longer breaks every API call.** Some MCPB-bundle hosts substitute an empty string for an unset optional `user_config` field, so `MCPINDEX_API_BASE=""` was being used verbatim as the base URL, turning every request into a broken relative URL. The base now falls back to `https://mcpindex.ai` on an empty value (`||` instead of `??`), so those hosts work out of the box. Source change was already on `main` at 0.3.7 but had not reached npm; this release ships it.
+
+### Changed
+
+- Swept em-dashes to hyphens in the `check_tool_trust` tool description and the update-check comments (house style).
+- Removed a no-op template expression in the recommendation output (`${r.name}@${r.qualityScore ? '' : ''}` always rendered `${r.name}`).
+
 ## [0.3.5] - 2026-07-12
 
 ### Changed

package/README.md

@@ -12,6 +12,16 @@ npm install -g mcp-server-mcpindex
 
 This is the **directory / advisory** client (recommend, search, trust). It does **not** install the in-path drift gate — that is `curl -fsSL https://mcpindex.ai/install.sh | sh`.
 
+### Or connect remotely (no install)
+
+Prefer not to install anything? mcpindex is also a **hosted remote MCP server**. Point any client that supports remote MCP (Claude connectors, Cursor, etc.) at:
+
+```
+https://mcpindex.ai/api/mcp
+```
+
+Streamable HTTP, no credentials. Same six tools as the npm package.
+
 ### Claude Code
 
 ```bash
@@ -215,6 +225,10 @@ MIT.
 
 - Website: [mcpindex.ai](https://mcpindex.ai)
 - Methodology: [mcpindex.ai/methodology](https://mcpindex.ai/methodology)
+- Screen a server: [mcpindex.ai/screen](https://mcpindex.ai/screen)
+- Guide: [Find the right MCP server by task](https://mcpindex.ai/guides/find-mcp-server-by-task)
 - Source: [github.com/mcpindex-ai](https://github.com/mcpindex-ai)
 
+[![mcp-server-mcpindex MCP server](https://glama.ai/mcp/servers/mcpindex-ai/mcp-server-mcpindex/badges/score.svg)](https://glama.ai/mcp/servers/mcpindex-ai/mcp-server-mcpindex)
+
 Unofficial. Not affiliated with Anthropic.

package/manifest.json

@@ -0,0 +1,55 @@
+{
+  "manifest_version": "0.2",
+  "name": "mcp-server-mcpindex",
+  "display_name": "mcpindex",
+  "version": "0.3.9",
+  "description": "The MCP directory that vets servers, not just lists them: search by task, then get an advisory screen on a server before an agent calls its tools. Advisory, conformance monitored not enforced, not a safety verdict.",
+  "long_description": "mcpindex is the MCP directory that vets servers, not just lists them. Search by task to find the right server (ranked picks with install commands and quality scores), then get an advisory screen on a specific tool or a whole server before your agent calls it: whether each tool does what it claims. check_tool_trust and assess_server return an advisory verdict (REVIEW / UNVERIFIED at v1), backed by conformance monitoring and a live drift ledger, and fail closed to human review. Zero-config: queries the public mcpindex.ai API, no credentials. Monitored, not enforced; not a safety verdict and not an in-path gate.",
+  "author": {
+    "name": "Bhartis LLC",
+    "email": "hello@mcpindex.ai",
+    "url": "https://mcpindex.ai"
+  },
+  "homepage": "https://mcpindex.ai",
+  "documentation": "https://mcpindex.ai/methodology",
+  "support": "https://github.com/mcpindex-ai/mcpindex-web/issues",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/mcpindex-ai/mcpindex-web"
+  },
+  "license": "MIT",
+  "keywords": [
+    "mcp",
+    "model-context-protocol",
+    "discovery",
+    "trust",
+    "tool-safety",
+    "registry"
+  ],
+  "server": {
+    "type": "node",
+    "entry_point": "src/index.mjs",
+    "mcp_config": {
+      "command": "node",
+      "args": ["${__dirname}/src/index.mjs"],
+      "env": {
+        "MCPINDEX_API_BASE": "${user_config.api_base}"
+      }
+    }
+  },
+  "tools_generated": true,
+  "user_config": {
+    "api_base": {
+      "type": "string",
+      "title": "API base URL",
+      "description": "Override the mcpindex API base if you self-host. Leave as the default otherwise.",
+      "default": "https://mcpindex.ai",
+      "required": false
+    }
+  },
+  "compatibility": {
+    "runtimes": {
+      "node": ">=18.0.0"
+    }
+  }
+}

package/package.json

@@ -1,8 +1,8 @@
 {
   "name": "mcp-server-mcpindex",
-  "version": "0.3.7",
+  "version": "0.3.9",
   "mcpName": "io.github.gautamgb/mcp-server-mcpindex",
-  "description": "An MCP server for finding MCP servers, plus advisory screen verdicts (check_tool_trust, assess_server). Directory client - not the in-path gate (mcpindex-gate). Drop-in for Claude Desktop, Claude Code, Cursor, Gemini CLI, Cline, Zed.",
+  "description": "The MCP directory that vets servers, not just lists them. Search by task, then get an advisory screen on a server before your agent calls its tools: whether each tool does what it claims, backed by conformance monitoring and a public drift ledger. Advisory (REVIEW / UNVERIFIED), monitored not enforced, not a safety verdict. Drop-in for Claude Desktop, Claude Code, Cursor, Gemini CLI, Cline, Zed.",
   "keywords": [
     "mcp",
     "model-context-protocol",
@@ -38,12 +38,15 @@
     "src/",
     "README.md",
     "CHANGELOG.md",
-    "LICENSE"
+    "LICENSE",
+    "manifest.json"
   ],
   "scripts": {
     "build": "node --check src/index.mjs && node --check src/trust.mjs && node --check src/update-check.mjs",
     "test": "node --test test/*.test.mjs",
     "check-published": "node scripts/check-published.mjs",
+    "sync-glama": "node scripts/sync-glama-repo.mjs",
+    "bundle": "node scripts/bundle-mcpb.mjs",
     "release": "node scripts/release.mjs"
   },
   "dependencies": {

package/src/index.mjs

@@ -12,15 +12,22 @@ import { createRequire } from 'node:module';
 export { checkToolTrust, assessServer, VERDICT_CONTRACT_VERSION, V1_HONEST_LIMITS } from './trust.mjs';
 import { notifyUpdateIfAvailable } from './update-check.mjs';
 
-const API_BASE = process.env.MCPINDEX_API_BASE ?? 'https://mcpindex.ai';
-// Single source of truth for the running version — read from package.json so the
+// `||` (not `??`) so an empty MCPINDEX_API_BASE - which some MCPB hosts substitute
+// for an unset optional user_config field - falls back to the default instead of
+// becoming "" and breaking every fetch with a relative URL.
+const API_BASE = process.env.MCPINDEX_API_BASE || 'https://mcpindex.ai';
+// Single source of truth for the running version - read from package.json so the
 // User-Agent and the update-check can never drift from what npm actually shipped.
 const PKG_VERSION = createRequire(import.meta.url)('../package.json').version;
+// Single source of truth for tool name/description, shared with the hosted
+// remote endpoint (mcpindex-web/app/api/[transport]/route.ts) so copy can't drift.
+const TOOL_META = createRequire(import.meta.url)('./tools-meta.json');
+const TOOL_DESC = Object.fromEntries(TOOL_META.map((m) => [m.name, m.description]));
 
 const server = new Server(
   { name: 'mcp-server-mcpindex', version: PKG_VERSION },
   // Tools only. We do NOT advertise `logging`: the update notice goes to stderr (which
-  // every host surfaces), not via `notifications/message` (rendered inconsistently — Cursor
+  // every host surfaces), not via `notifications/message` (rendered inconsistently - Cursor
   // logs it as a bare ` undefined`). stderr is the universal, clean channel.
   { capabilities: { tools: {} } },
 );
@@ -29,7 +36,7 @@ const TOOLS = [
   {
     name: 'recommend_mcp_for_task',
     description:
-      'Recommend the best MCP servers for a natural-language task. Returns top 3 ranked picks with reasoning, install commands, and quality scores. Use this when the user asks for the right MCP server for a task they want to do.',
+      TOOL_DESC.recommend_mcp_for_task,
     inputSchema: {
       type: 'object',
       properties: {
@@ -45,7 +52,7 @@ const TOOLS = [
   {
     name: 'search_mcp_servers',
     description:
-      'Keyword + semantic search across the full MCP server registry. Use when the user knows what tool category they want but not which server.',
+      TOOL_DESC.search_mcp_servers,
     inputSchema: {
       type: 'object',
       properties: {
@@ -67,7 +74,7 @@ const TOOLS = [
   {
     name: 'get_install_command',
     description:
-      'Get the exact install command for a given MCP server and client. Returns a JSON block ready to paste into the client config.',
+      TOOL_DESC.get_install_command,
     inputSchema: {
       type: 'object',
       properties: {
@@ -88,7 +95,7 @@ const TOOLS = [
   {
     name: 'compare_servers',
     description:
-      'Side-by-side comparison of 2-5 MCP servers - quality scores, install paths, transport types, env vars.',
+      TOOL_DESC.compare_servers,
     inputSchema: {
       type: 'object',
       properties: {
@@ -106,7 +113,7 @@ const TOOLS = [
   {
     name: 'check_tool_trust',
     description:
-      'Pre-invocation advisory screen for a specific tool on an MCP server. Returns an advisory verdict object (directive ALLOW | DENY | REVIEW | UNVERIFIED, dimensions, freshness). At v1 the public screen produces REVIEW or UNVERIFIED only — ALLOW/DENY are reserved. Not the in-path gate (mcpindex-gate). Agents SHOULD treat UNVERIFIED as "human review required", never as ALLOW.',
+      TOOL_DESC.check_tool_trust,
     inputSchema: {
       type: 'object',
       properties: {
@@ -125,7 +132,7 @@ const TOOLS = [
   {
     name: 'assess_server',
     description:
-      'Aggregated pre-flight trust assessment across all tools on an MCP server. Same verdict shape as check_tool_trust. Use for "is THIS server worth integrating?" decisions. v1 advisory; conformance monitored not enforced; verdicts may be UNVERIFIED if not yet probed.',
+      TOOL_DESC.assess_server,
     inputSchema: {
       type: 'object',
       properties: {
@@ -227,7 +234,7 @@ function formatRecommend(data) {
   const lines = [`Top ${data.recommendations.length} for: "${data.task}"`, ''];
   for (const r of data.recommendations) {
     lines.push(`[${r.rank}] ${r.title}  ·  QS ${r.qualityScore}/100  ·  ${r.category}`);
-    lines.push(`    ${r.name}@${r.qualityScore ? '' : ''}`);
+    lines.push(`    ${r.name}`);
     lines.push(`    ${r.reasoning}`);
     const install = r.installs.npm
       ? `npx -y ${r.installs.npm}`
@@ -292,7 +299,7 @@ const transport = new StdioServerTransport();
 await server.connect(transport);
 console.error('[mcp-server-mcpindex] connected via stdio');
 
-// Fire-and-forget: tell the user if a newer version exists (stderr only — the channel
+// Fire-and-forget: tell the user if a newer version exists (stderr only - the channel
 // every host renders cleanly). Dropped onto the event loop AFTER connect so it can never
 // delay or crash startup; all errors are swallowed inside.
 notifyUpdateIfAvailable({ currentVersion: PKG_VERSION }).catch(() => {});

package/src/tools-meta.json

@@ -0,0 +1,32 @@
+[
+  {
+    "name": "recommend_mcp_for_task",
+    "title": "Recommend MCP servers for a task",
+    "description": "Recommend the best MCP servers for a natural-language task. Returns top 3 ranked picks with reasoning, install commands, and quality scores. Use this when the user asks for the right MCP server for a task they want to do."
+  },
+  {
+    "name": "search_mcp_servers",
+    "title": "Search MCP servers",
+    "description": "Keyword + semantic search across the full MCP server registry. Use when the user knows what tool category they want but not which server."
+  },
+  {
+    "name": "get_install_command",
+    "title": "Get install command",
+    "description": "Get the exact install command for a given MCP server and client. Returns a JSON block ready to paste into the client config."
+  },
+  {
+    "name": "compare_servers",
+    "title": "Compare MCP servers",
+    "description": "Side-by-side comparison of 2-5 MCP servers - quality scores, install paths, transport types, env vars."
+  },
+  {
+    "name": "check_tool_trust",
+    "title": "Check tool trust (advisory)",
+    "description": "Pre-invocation advisory screen for a specific tool on an MCP server. Returns an advisory verdict object (directive ALLOW | DENY | REVIEW | UNVERIFIED, dimensions, freshness). At v1 the public screen produces REVIEW or UNVERIFIED only - ALLOW/DENY are reserved. Not the in-path gate (mcpindex-gate). Agents SHOULD treat UNVERIFIED as \"human review required\", never as ALLOW."
+  },
+  {
+    "name": "assess_server",
+    "title": "Assess server trust (advisory)",
+    "description": "Aggregated pre-flight trust assessment across all tools on an MCP server. Same verdict shape as check_tool_trust. Use for \"is THIS server worth integrating?\" decisions. v1 advisory; conformance monitored not enforced; verdicts may be UNVERIFIED if not yet probed."
+  }
+]

package/src/update-check.mjs

@@ -1,12 +1,12 @@
-// update-check.mjs — best-effort "a newer mcp-server-mcpindex exists" notice.
+// update-check.mjs - best-effort "a newer mcp-server-mcpindex exists" notice.
 //
 // Why this is safe to ship in a server that already egresses:
 //   - outbound to the PINNED npm registry host only, https, no redirect-following
 //     (no SSRF pivot), time-boxed, and fail-silent on ANY error;
-//   - fire-and-forget — it never blocks or crashes startup (the caller drops it
+//   - fire-and-forget - it never blocks or crashes startup (the caller drops it
 //     onto the event loop after connect and ignores rejections);
 //   - no telemetry beyond the standard registry GET (no version of the user, no
-//     machine id — just "what's the latest published version of this package");
+//     machine id - just "what's the latest published version of this package");
 //   - opt-out via MCPINDEX_NO_UPDATE_CHECK.
 //
 // Pure + injectable (fetchImpl) so it is unit-testable with no network.
@@ -88,11 +88,11 @@ export async function fetchLatestVersion({
 }
 
 /** Orchestration: check, and if a newer version exists, emit the notice to STDERR only.
- *  stderr is the UNIVERSAL channel — every MCP host (Cursor, Claude Desktop/Code, Gemini
+ *  stderr is the UNIVERSAL channel - every MCP host (Cursor, Claude Desktop/Code, Gemini
  *  CLI, …) surfaces a spawned server's stderr in its per-server log. We deliberately do NOT
  *  emit an MCP `notifications/message`: hosts render it inconsistently (Cursor logs it as a
  *  bare ` undefined`, swallowing the text), so it only adds noise where stderr already
- *  carries the message cleanly. Returns the message it emitted (or null) — handy for
+ *  carries the message cleanly. Returns the message it emitted (or null) - handy for
  *  tests/callers. Never throws; never blocks the caller (caller fire-and-forgets). */
 export async function notifyUpdateIfAvailable({
   currentVersion,
@@ -106,7 +106,7 @@ export async function notifyUpdateIfAvailable({
     const latest = await fetchLatestVersion({ pkg, fetchImpl });
     if (!latest || !isOlder(currentVersion, latest)) return null;
     const msg = formatUpdateMessage(currentVersion, latest);
-    log(msg); // stderr — the one channel every host renders cleanly
+    log(msg); // stderr - the one channel every host renders cleanly
     return msg;
   } catch {
     return null; // belt-and-suspenders: this path must never surface an error